Stage 3: deploy FastAPI ASGI shell as Cloud Run candidate

[anth-volk]

Context

Stage 3 of the API migration should make the FastAPI ASGI shell deployable as a Cloud Run candidate while keeping App Engine as the public production API host.

Scope

• Add a Cloud Run runtime for policyengine_api.asgi:app.
• Deploy tagged no-traffic Cloud Run candidate revisions in staging and production.
• Run deployed-service tests against the Cloud Run candidate before promoting the Cloud Run service URL.
• Keep the public App Engine/custom API URL unchanged.
• Connect the deployed Cloud Run service to the existing production Cloud SQL instance, while keeping unit tests off production DBs.
• Use a dedicated Cloud Run runtime service account separate from the GitHub deploy service account.
• Expose public Cloud Run health probes, including simulation-gateway dependency health.

Success criteria

• Staging deploys both App Engine and Cloud Run tracks and validates both with live integration tests.
• Production deploys App Engine and Cloud Run candidate tracks without migrating the public API URL.
• Cloud Run candidate smoke tests are read-only and use pre-existing fixtures.
• Cloud Run runtime identity has only the permissions needed for runtime operation.
• Migration tracking/logging identifies Cloud Run-hosted FastAPI-native health routes.